From 7bc7a8d0abe6e263737eae31aadc250cdc4bc901 Mon Sep 17 00:00:00 2001
From: QuantumGhost <obelisk.reg+git@gmail.com>
Date: Fri, 16 Jan 2026 18:18:37 +0800
Subject: [PATCH] Length limit for UserAction fields (vibe-kanban e9ec1f07)

Add the following length limit to UserAction fields:

- limit the length of `id` to 20 chars.
- limit the length of title to 40 chars.

Add some unit tests to ensure the validation rules are enforced.
---
 .../workflow/nodes/human_input/entities.py    |  4 +--
 .../nodes/human_input/test_entities.py        | 28 +++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/api/core/workflow/nodes/human_input/entities.py b/api/core/workflow/nodes/human_input/entities.py
index 29d37fa882..a9153c07e2 100644
--- a/api/core/workflow/nodes/human_input/entities.py
+++ b/api/core/workflow/nodes/human_input/entities.py
@@ -166,8 +166,8 @@ class UserAction(BaseModel):
     # It also serves as the identifiers of output handle.
     #
     # The id must be a valid identifier (satisfy the _IDENTIFIER_PATTERN above.)
-    id: str
-    title: str
+    id: str = Field(max_length=20)
+    title: str = Field(max_length=20)
     button_style: ButtonStyle = ButtonStyle.DEFAULT
 
     @field_validator("id")
diff --git a/api/tests/unit_tests/core/workflow/nodes/human_input/test_entities.py b/api/tests/unit_tests/core/workflow/nodes/human_input/test_entities.py
index c7e081b3f4..ed634273ad 100644
--- a/api/tests/unit_tests/core/workflow/nodes/human_input/test_entities.py
+++ b/api/tests/unit_tests/core/workflow/nodes/human_input/test_entities.py
@@ -126,6 +126,34 @@ class TestUserAction:
 
         assert action.button_style == ButtonStyle.DEFAULT
 
+    def test_user_action_length_boundaries(self):
+        """Test user action id and title length boundaries."""
+        action = UserAction(id="a" * 20, title="b" * 20)
+
+        assert action.id == "a" * 20
+        assert action.title == "b" * 20
+
+    @pytest.mark.parametrize(
+        ("field_name", "value"),
+        [
+            ("id", "a" * 21),
+            ("title", "b" * 21),
+        ],
+    )
+    def test_user_action_length_limits(self, field_name: str, value: str):
+        """User action fields should enforce max length."""
+        data = {"id": "approve", "title": "Approve"}
+        data[field_name] = value
+
+        with pytest.raises(ValidationError) as exc_info:
+            UserAction(**data)
+
+        errors = exc_info.value.errors()
+        assert any(
+            error["loc"] == (field_name,) and error["type"] == "string_too_long"
+            for error in errors
+        )
+
 
 class TestHumanInputNodeData:
     """Test HumanInputNodeData entity."""